…-sender

Adds the privacy guardrail that gates Layer 2's default-on rollout.
Users can now mark individual indexed pages as pinned (×2 score) or
hidden (dropped from search entirely), and bulk-hide every page from a
given sender in one click.

Engine:
- buildPageMetadata stamps lower-cased `fromAddress` on every page
  whose signal carries `data.from`. The connector inlines a 3-line
  display-name stripper to avoid pulling @skytwin/connectors into the
  memory layer's dep graph.
- `updatePageMetadata(userId, pageId, patch)` repository helper:
  JSONB-merges a partial patch into brain_pages.metadata, scoped by
  user_id so a guessable id can't be used to mutate another user's
  rows. Returns affected count; 0 → 404 at the route layer.
- `hideAllPagesFromSender(userId, fromAddress)` repository helper:
  bulk UPDATE on every page where `metadata->>'fromAddress'` matches.
  Lower-cases the input to match the stamped form.
- In-memory mirrors of both for tests.

API:
- POST /api/memory-config/pages/:pageId/override with body
  { override: 'pinned' | 'hidden' | null }. 404 on missing or
  foreign-owned page (deliberately collapsed so a caller can't probe).
- POST /api/memory-config/senders/hide with body { fromAddress }.
  Returns { ok, fromAddress, hidden: <count> }.
- /api/memory-config/dashboard `pages.recent[]` now includes
  `fromAddress` so the UI knows what to send to the sender route.

Web:
- Per-row actions on the Recent pages table: Pin/Unpin, Hide/Unhide,
  Hide sender. Buttons swap action based on current state. Sender
  button only appears when a fromAddress exists (i.e. email-derived).
  The bulk action confirms before firing.

Tests: +5 in-memory unit, +3 embedded-port, +6 routes. All green.

This unblocks the eventual Layer 2 default-on rollout — combined with
the labeled-retrieval eval guardrail from PR #260, users now have both
a working multiplier and a path to disclaim what they don't want
amplified.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Two findings on the privacy/exclude UI, both valid:

1. JSONB null-clear comment was actually wrong. `jsonb_a || jsonb_b`
   does NOT strip null values — it stores them as JSON null. The
   pin/hide path used `{ userOverride: null }` and the resulting
   metadata column would have ended up with `{"userOverride": null}`
   instead of the key being absent. tierMultiplier treats both as
   "no override," so functionally it worked, but the column shape
   would have drifted.

   Fixed the helper itself rather than just the comment. `updatePageMetadata`
   now splits the patch into "set" (non-null values, applied via JSONB ||)
   and "drop" (null values, applied via JSONB - 'key'). In-memory mirror
   matches. New unit test verifies the cleared key is *absent*, not
   present-and-null.

2. fromAddress trimmed for validation but not normalized for the
   adapter call. Inputs like "  Spam@Vendor.Example.com  " passed
   validation but never matched the trimmed + lowered stored values,
   leading to a confusing `hidden: 0`. Normalize once at the route
   boundary (trim + lower) and use the canonical form for the adapter
   call, the response, and any logged context. Existing test updated
   to assert the trim-and-lower path.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>